Depends on #18, which adds the watchdog/ category and the two entries that establish its conventions. Read those first; this issue assumes them.
Desired behavior
Pause when authentication failures against a monitored surface exceed a threshold inside a bounded window — the measurable core of a credential-stuffing or brute-force control, expressed as a replayable rule rather than a dashboard alert.
Expected inputs
One host-provided series, following the watchdog/ direction convention — nonnegative, rising as the situation worsens, so the rule is a >= against a ceiling like every other control in the category:
AUTH_FAILURES_5M — count of failed authentication attempts in the trailing five-minute window, as the host counts them.
Whether the count is per-account, per-source, or global is a real design decision and it changes what the rule means. Pick one, put it in the signal name if that helps, and state it in the header — a global count is a different control from a per-account count, and a threshold tuned for one is wrong for the other.
What Nano is responsible for
Comparing the count to the threshold and emitting an intent. That is all.
What remains host responsibility
Everything that makes this a security control: collecting the events, defining "failure", owning the window boundary, deciding whether the proposal is acted on, and performing any lockout. Nano cannot read a log, lock an account, or block an address, and the header should say so plainly.
Expected result
pause(), escalating to agent SecurityDesk to match trusted_route_guard. No direction ever proposed — tests/test_library.py enforces PAUSE/OBSERVE only for this category.
Consider whether pause is right at all. A single threshold crossing may deserve observe() and a higher one pause(); if you think so, propose both as a pair in one PR and say where the line is.
Expected tests
None required — the library tests discover the pair. Add a focused test only for a boundary worth pinning, with a positive control beside every no-fire assertion.
Boundary
No network, no clock, no external actuation. Nano proposes; the host's DecisionGate decides.
How to submit
docs/first-contribution.md, then python scripts/check_contribution.py --write nano/library/watchdog/auth_failure_burst.nano. Add the signal to the watchdog table in nano/library/README.md.
Desired behavior
Pause when authentication failures against a monitored surface exceed a threshold inside a bounded window — the measurable core of a credential-stuffing or brute-force control, expressed as a replayable rule rather than a dashboard alert.
Expected inputs
One host-provided series, following the
watchdog/direction convention — nonnegative, rising as the situation worsens, so the rule is a>=against a ceiling like every other control in the category:AUTH_FAILURES_5M— count of failed authentication attempts in the trailing five-minute window, as the host counts them.Whether the count is per-account, per-source, or global is a real design decision and it changes what the rule means. Pick one, put it in the signal name if that helps, and state it in the header — a global count is a different control from a per-account count, and a threshold tuned for one is wrong for the other.
What Nano is responsible for
Comparing the count to the threshold and emitting an intent. That is all.
What remains host responsibility
Everything that makes this a security control: collecting the events, defining "failure", owning the window boundary, deciding whether the proposal is acted on, and performing any lockout. Nano cannot read a log, lock an account, or block an address, and the header should say so plainly.
Expected result
pause(), escalating toagent SecurityDeskto matchtrusted_route_guard. No direction ever proposed —tests/test_library.pyenforcesPAUSE/OBSERVEonly for this category.Consider whether
pauseis right at all. A single threshold crossing may deserveobserve()and a higher onepause(); if you think so, propose both as a pair in one PR and say where the line is.Expected tests
None required — the library tests discover the pair. Add a focused test only for a boundary worth pinning, with a positive control beside every no-fire assertion.
Boundary
No network, no clock, no external actuation. Nano proposes; the host's
DecisionGatedecides.How to submit
docs/first-contribution.md, then
python scripts/check_contribution.py --write nano/library/watchdog/auth_failure_burst.nano. Add the signal to the watchdog table innano/library/README.md.